SOBRE ESTE BLOG

Welcome to the System z Management Blog, where you can read the perspectives from System z experts. This Blog provides insights into the System z solution, as well as technical details about specific IBM products.

IBM zAware is a z/OS log analytics tool which is offered as a priced feature of the zEnterprise EC12 mainframe system. This ‘appliance’ is designed to consume and analyze messages from one or more z/OS systems in your environment. The process starts with a 90-day ‘training period’ where IBM zAware processes 90 days of operlog messages for each z/OS system being monitored. This training period is broken down into 10-minute periods which are used to form a ‘baseline’ for usual behavior for each system.

Once IBM zAware derives the system’s baseline behavior, IBM zAware analyzes operlog messages in 10-minute ‘chunks’ where each ‘chunk’ of messages is compared to a set of baseline message for that same period. For example, IBM zAware will compare the 10-minute period of messages generated from 9am to 9:10am on Monday with 10-minute chunks of messages in the baseline to determine if an anomaly should be surfaced.

This analysis is intended to surface ‘abnormal’ message activity on your systems. IBM zAware is designed to report anomalies when new messages occur, when certain words appear in messages (ABEND, etc), when certain error message IDs occur and when certain messages are missing from a ‘cluster’ of messages that are normally displayed. This type of analysis has been proven to be especially helpful in situations where the systems and components of the systems appear to be healthy, but in reality, are not. We often refer to this state as ‘Sick but not Dead’.

Now, let’s compare this to pro-active behavior that is provided by traditional automation and availability and monitoring tools. NetView and Tivoli Systems Automation provide a very rich set of automation capabilities that can be used to perform automated responses for messages and events. In many cases, these automated responses will replace the need for manual intervention and can ensure 24/7 ‘uptime’ for those critical applications running in your enterprise. Additionally, NetView provides real-time monitoring for availability of the TCP/IP and SNA network components by querying their status (Up, Down, Activated, Deactivated, etc).

Similarly, the OMEGAMON and ITCAM products perform a similar function but with respect to performance. After all, a system that is down is just as bad as a system that is performing so poorly that it cannot process work in a timely manner. The OMEGAMONs enable performance monitoring for z/OS as well as the middleware and applications that run on the middleware.

Initial feedback from early adopters of IBM zAware has shown that many customers do not currently have sufficient message automation (NetView) or the appropriate level of situation processing (OMEGAMON) running in their enterprise. In many instances, insights from IBM zAware have prompted systems administrators to beef up their automation and situation processing in order to avoid anomalies from re-occurring. IBM zAware should be considered as an important component of your pro-active monitoring ‘ecosystem’, providing an additional perspective on system health.

In summary, consider IBM zAware as additional perspective on the health for your systems. Insights from IBM zAware, when integrated with insights from traditional monitoring and automation tools provide a more complete view of system health.